[Bug 44003] New: Origin: BF3WebHelper.exe crashes because injection of igo32.dll fails.

[wine-bugs at winehq.org]

https://bugs.winehq.org/show_bug.cgi?id=44003

            Bug ID: 44003
           Summary: Origin: BF3WebHelper.exe crashes because injection of
                    igo32.dll fails.
           Product: Wine-staging
           Version: 2.20
          Hardware: x86
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: -unknown
          Assignee: wine-bugs at winehq.org
          Reporter: bernhardu at mailbox.org
                CC: erich.e.hoover at wine-staging.com, michael at fds-team.de,
                    sebastian at fds-team.de
      Distribution: ---

Created attachment 59662
  --> https://bugs.winehq.org/attachment.cgi?id=59662
Standalone demonstration of the issue similar to what Origin does.

When starting a game from Origin a crash dialog for BF3WebHelper.exe is shown.
Shift+right click - "Debug" seems to get another thread further, so it can
successfully then still execute Firefox.exe.

Used a self built wine-2.20 with the whole staging patch set applied.

Tried to get an idea of what happens:
- Origin calculates the entry point for LoadLibrary using the kernel32 fake dll
  and the base address of its own process.
- CreateProcess with suspended flag is called for BF3WebHelper.exe
- Memory for the to be loaded dll is reserved and filled in
  the new process ("...\\igo32.dll").
- A second thread in the new process is created by CreateRemoteThread using
  the calculated entry point for kernel32.fake.LoadLibrary above.
- This thread crashes because it looks like in the in memory kernel32 module
  is something different/uninitialized at the used entry point.

With +BF3WebHelper.exe:all crash does not happen.
(But is still not executing LoadLibrary and seems not to crash by "accident".)

Attached is a demonstration of what happens.

-- 
Do not reply to this email, post in Bugzilla using the
above URL to reply.
You are receiving this mail because:
You are watching all bug changes.